[Bugs5382]

What and why

ACME and EST could only be switched on by a hand-staged YAML file: MachineConfig had no field for them, so config apply, the maintenance install and the Fleet Manager could not switch either protocol on, change it or switch it off, and GetStatus could not say what a node serves. CryptOS-PKI/api#115 adds the contract (Pki.acme, Pki.est, NodeStatus.protocols, config_reboot_pending). This is the node side.

• Mapping. FromProto/ToProto carry both blocks field for field, and CarryForwardProtoGaps is gone. ToProto always sends an explicit block, enabled: false for an off protocol. FromProto turns enabled: false (or no block) into nil, the node's existing "off".
• Apply rules (config.FromProtoOver, used by ApplyConfig, the maintenance install and re-provision): an absent block keeps the stored one; enabled: false switches off; enabled: true switches on and is validated.
• Write-only secrets. GetConfig returns hmac_key_base64 and password_sha256 blank. An apply with a blank secret keeps the stored value for the same key_id/username; a blank secret for an unknown identifier is refused (... empty, and the node has no stored key for key_id "x" to keep). Removing an entry revokes it. cryptosctl config apply accepts the blanks client-side (config.ParseForApply), so config get output can be fed straight back.
• Root refusal. Validate refuses pki.acme or pki.est on a Root. That one rule covers config apply, the maintenance install, re-provision and ceremony start --config, which parses the raw YAML before storing it, so a Root can no longer pick up ACME or EST at its next boot.
• Boot only. The listeners already started only at boot from the stored config (steps 12c/12d in internal/init/run.go); that stays, with a log line when a protocol is off. Every protocol change is outside the hot fields, so it answers requires_reboot: true.
• Status. NodeStatus.protocols reports each protocol's configured state (stored config), running state (this boot) and reboot_pending (stored block differs from the boot one); config_reboot_pending is NeedsReboot(boot config, stored config). cryptosctl status prints Protocols: ACME on (not running, reboot pending), EST off and a Reboot: pending line.
• Found on the way. An unchanged re-apply over the wire always answered requires_reboot=true (same digest), because gRPC turns an empty list into nil and NeedsReboot used reflect.DeepEqual against the stored YAML's empty slices. NeedsReboot now compares the stored YAML form (config.Equivalent).

Design calls:

• enabled: false stores nothing, not a disabled block with its settings. The proto allows either, and nil is the node's single meaning of "off"; keeping settings for a later switch-on can be added without a contract change.
• A Root refusal lives in Validate, so every path gets it. A Root whose stored config already has one of these blocks would fail to parse at its next boot and drop to maintenance; no lab config has one, and a Root serving ACME already broke Root Mode, so failing closed is right.

api pin. github.com/CryptOS-PKI/api is pinned to api main at 81494db, which carries CryptOS-PKI/api#115 (this contract), CryptOS-PKI/api#123 (the manager's SetNodeProtocol) and CryptOS-PKI/api#104. Api main also has the SCEP challenge and approval RPCs (CryptOS-PKI/api#117) and ListTsaCertificates (CryptOS-PKI/api#120), which this node does not serve yet, so internal/grpc/unserved.go answers them Unimplemented (tested in unserved_test.go). #288 replaces the SCEP stubs with its handlers when it rebases. The wip/284-api-integration api branch is no longer used.

Tests removed, because the function they covered is gone: TestCarryForwardProtoGaps, TestCarryForwardProtoGaps_DoesNotOverwrite and TestCarryForwardProtoGaps_NilSafe (the absent-block keep they guarded is now TestFromProtoOverAbsentBlockKeepsStored and TestConfigStoreApply_AbsentBlockKeepsProtocol). Fixtures moved from a Root to an issuing node, because a Root can no longer carry these blocks: the ACME and EST validation tests in internal/config, TestConfigStoreApply_PreservesProtocols and the TestConfigStoreApply_RejectsInvalidConfig seed.

Closes #284

Related: #205, CryptOS-PKI/api#114, CryptOS-PKI/cryptos-manager#84, CryptOS-PKI/cryptos-manager#61.

Rebased onto main and landed by the Linux box at the owner's request. Main in this repo is not relicensed yet (#291 is still open). The rebase conflicted only in internal/init/run.go (the ACME listener log line): main's !cfg.PKI.ACME.AllowAnonymousAccounts argument is kept, with this PR's "ACME: off in the boot config" branch. Every commit is signed off. New files carry the header task license checks on main today; #291 restamps them with the rest of the tree.

Checked against the Fleet Manager on main: SetNodeProtocol reads GetConfig, flips one block's enabled flag, sends secrets blank and leaves the other block out. The node keeps stored secrets for a blank value, keeps an absent block, reports both ACME and EST in NodeStatus.protocols, and refuses a Root, which is what the manager's reboot tracking and error passthrough expect. Because enabled: false stores nothing, the block the manager reads back for an off protocol is empty, so switching a protocol on from the manager is refused by validation until the operator applies a full block; the docs site already says the manager does not fill in settings.

Docs: docs/acme.md and docs/est.md gain a "Switching it on, changing it and switching it off" section (Root refusal, reboot and maintenance-window callout, write-only secrets) and lose the "not yet carried in the proto" limit. The docs/est.md status example now lists ACME before EST, as cryptosctl status prints it. Companion docs-site pages, all already merged and checked against this code after the rebase:

• docs(reference): write the reference pages from the alpha docs#35 (docs/20-reference-pages, 3a1ae8d): machine-config-enrollment and machine-config: switching, reboot and maintenance-window callout, write-only secrets, Root refusal, the new error messages.
• docs(use-cases): write the use-cases pages from the alpha docs#31 (docs/25-use-cases-pages, ec537ec): overview, internal-tls, devices-iot, kubernetes no longer say ACME and EST can't be switched on.
• docs(using): write the using pages from the alpha docs#29 (docs/21-using-pages, 5de6b06): config-apply, status (Protocols and Reboot lines), ceremony-start (Root refusal).
• docs(concepts): write the concepts pages from the alpha docs#34 (docs/27-concepts-pages, 7b714dc): declarative-config and ca-roles.

Verification

• Lint clean (golangci-lint run ./... v2.12.2, also with GOOS=linux; gofmt; go vet)
• Tests pass (go test ./...)
• Build succeeds (task build)
• Documentation updated

How this was verified

• Tests first for each point; each new test failed before its implementation (stubs showed the round trip, enabled flag, Root rule and status failures; the CLI round trip failed on the client-side secret check, then on the reboot misreport). Mutation checks: returning unredacted config from Current fails TestConfigStoreApply_ACMEOnThenOff; disabling the Root rule fails TestStart_RootWithProtocolRefused.
• New tests: internal/config/protocols_test.go (round trip, enabled flag, redaction, absent/disabled/blank-secret/unknown-identifier/revoked-entry apply rules, Root refusal in Validate and Parse, ParseForApply, reboot classification), TestNeedsRebootIgnoresNilVersusEmpty, internal/node/protocols_test.go (apply round trip ACME on, read back, unchanged re-apply, off; absent block kept; secretless new credential refused; Root refused; status configured/running/pending across an apply and a reboot), internal/init/install_protocols_test.go (maintenance install and re-provision carry the blocks, empty secret refused before the disk is touched, Root refused), TestStart_RootWithProtocolRefused (ceremony path, nothing stored), cmd/cryptosctl/protocols_test.go (status line, config get then config apply against the test server keeps the secret with requires_reboot=false).
• task license (golic dry run): 0 files to change.
• Gitleaks read the hard-coded SHA-256 test digest in the first commit as a generic API key. The fixture now uses the existing testPasswordDigest() helper, and .gitleaksignore records that single finding (now commit 205dd64 after the rebase, internal/config/protocols_test.go:30) rather than rewriting the branch. gitleaks detect 8.30.1 locally: 1 finding without the entry, none with it.
• On macOS the TPM-simulator tests need GOTOOLCHAIN=go1.26.6 with the 26.5 SDK, and internal/grpc's Unix-socket test needs a short TMPDIR; both are local-environment limits, not code.
• Real-host check still owed: boot an issuing node, config apply ACME on, confirm cryptosctl status shows it pending, reboot, confirm the listener is up and the status line clears.

Merge order: the api contracts are merged, so this PR merges next, then #271 and #288 rebase onto it (#271 overlaps in go.mod, internal/config/config.go, internal/init/run.go and the status output; #288 replaces the SCEP stubs), then #291 restamps the headers. #296 carries copies of this PR's commits and rebases after it merges.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Merging for the v0.1.0 test run: CI green and mergeable at merge time.